Three ways a small SOC can cover the night shift

Why is the night the deciding question?

Every model looks fine at 11 a.m. on a Tuesday. A small team cannot put analysts on every night and weekend shift without burning out, so the question for any model is what happens to an alert that needs a decision at 3 a.m. on a Sunday. Answer that first, and the rest of the choice gets simpler.

Option 1: agents with a tight action catalog

An AI SOC analyst platform keeps investigating at night. Dropzone AI, for example, states 24/7 investigation. The question is what the software may do with a verdict when nobody is awake to approve. With a response action catalog, you mark the narrow, reversible actions that may run alone on trusted categories, such as quarantining a single phishing email, and everything else waits for morning or pages an on-call lead.

Several vendors describe settings that map to this. Mate Security describes graduated autonomy with guardrails: Recommend only, Supervised, and Auto-run for trusted categories under audit. Prophet Security describes scoped Agent Actions that run autonomously or with sign-off.

How it fails: a wide action that cannot wait, with nobody to approve it. Mitigate with an on-call rota limited to those rare cases, and test it.

Option 2: the vendor's managed option

Some AI SOC vendors sell a human layer on top of their software. In our profiles, Prophet Security offers Watchtower, a 24x7x365 human-in-the-loop expert service, and 7AI offers PLAID ELITE, in which its experts run the platform around the clock. The advantage is one system and one case record: the people at night work in the same product your team uses by day.

How it fails: the contract does not say which actions the vendor's people may take alone, so the first serious night incident becomes a negotiation. Write the catalog's night column into the agreement.

Option 3: an MDR provider for nights

A separate MDR provider covers nights and weekends while your team runs the day. This gives you the widest choice of providers and lets you keep whatever product you use by day. Five MDR providers now have lighter profiles on this site; none publishes a price, so compare offers on the questions in the primer lesson on what MDR buys.

How it fails: two systems and two case records. The provider cannot see what your team decided in the afternoon, or your team cannot see what the provider did overnight. Insist on one case record, as covered in the primer lesson on hand-offs.

How do you choose between them?

• If your night volume is small and most night alerts can wait, option 1 may be enough.
• If you want people at night but one product, option 2.
• If you want people at night and freedom to choose the product separately, option 3.

What should you test before deciding?

Run the same exercise for each option: raise an alert at 2 a.m. that needs a mid-risk action, such as isolating a laptop, and trace who sees it, who decides, how long it takes and where the record lands. The option with the shortest trace and the fewest people involved is usually the right one for a small team.

Does this change the model?

It can. A team that answers "nobody, and it cannot wait" to the night question is choosing MDR or a managed option, whatever it planned to buy. The fit finder reflects this in the sourcing question: the answer "our team by day, outside help for nights" adds the managed service need to the vendor list.

What does each option cost to run?

None of the vendors we profiled publishes list prices, so we cannot compare cost directly. What we can say is where the cost sits. Option 1 costs mainly the software and the effort of writing and reviewing the action catalog. Option 2 adds a service fee to the software. Option 3 adds a separate contract and the integration work between two systems. Ask each vendor or provider for the pricing basis in writing, and compare it with the cost of one more analyst on an on-call rota.